General
- Target c0d461ef0985e5200de25a231d15845e.exe
- Size 901KB
- Sample210818-dmenb7g46n
- SHA256 006dac8da13a28a8c98c6ec8ef112ee55544e0c4676cd2ffb393cb3cd66ebe15
- MD5 c0d461ef0985e5200de25a231d15845e
- SHA1 9a4a64d7e1ebd92752b968c0da6412869f6b1220
- SHA512 0a30ab792f80ccbe68e8730f0655aafbf722075efd4d2b33f01f8b7bbb450d87fca2d58e28ec7c1c39881cd06b32500473774129324a06c8a8a58ec2d888f147
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
c0d461ef0985e5200de25a231d15845e.exe
Resource
win7v20210408
Malware Config
Extracted
-
formbook
-
4.1
-
gz92
-
http://www.peggeorge.com/gz92/
-
ayurvedichealthformulas.com
-
plazaconstrutora.com
-
nat-hetong.info
-
eapdigital.com
-
ibluebaytvwdshop.com
-
committable.com
-
escapesbyek.com
-
mywebdesigner.pro
-
jianianhong.com
-
benvenutoqui.com
-
beiyet.com
-
theartofgifs.com
-
mbwvyksnk.icu
-
nshahwelfare.com
-
hhhservice.com
-
thechaibali.com
-
travelscreen.expert
-
best123-movies.com
-
leiahin.com
-
runplay11.com
-
oorulyh.icu
-
mypatchworkfamily.com
-
twerkwhileyouworkplanners.com
-
bradentonroofwashing.com
-
donandy.com
-
lonewolfchad.com
-
celsisenergy.net
-
humanweed.com
-
rosybakery.com
-
cookinwithsugarlious.com
-
1s5dnwzwv8tht8vi0v78kde4e.com
-
heyshopy.com
-
chibiaegyoshop.com
-
neverbrokerage.com
-
theadventurebench.com
-
psicologiapaula.com
-
xinke518.com
-
re-change.net
-
prodj-gear.com
-
iamworldwideshop.com
-
onlinemusiclessons.info
-
yxsc576.com
-
staniselevators.com
-
goldenleashcanine.com
-
luxormedikal.com
-
protectcentralcoast.com
-
jaysfinefood.com
-
zeneanyasbyerika.com
-
t-algorithm.net
-
busty-italian.com
-
bestlawnkzoo.com
-
bakeology.store
-
assured-justice-nl.com
-
sexf5.com
-
liveyourmaverick.com
-
mkt10697.com
-
suxfi.com
-
cardiociencia.net
-
truetoselfclothing.com
-
mcgrudersfitness.com
-
savorfullpoints.com
-
naturesblendsupplements.com
-
eseskalierteh.com
-
netechsupport.com
Targets
-
- Target c0d461ef0985e5200de25a231d15845e.exe
- Size 901KB
- SHA256 006dac8da13a28a8c98c6ec8ef112ee55544e0c4676cd2ffb393cb3cd66ebe15
- MD5 c0d461ef0985e5200de25a231d15845e
- SHA1 9a4a64d7e1ebd92752b968c0da6412869f6b1220
- SHA512 0a30ab792f80ccbe68e8730f0655aafbf722075efd4d2b33f01f8b7bbb450d87fca2d58e28ec7c1c39881cd06b32500473774129324a06c8a8a58ec2d888f147
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext